fix: Transfers were not syncing between accounts (#987)

* fix: Include investment_contribution in transfer? check and protect transfer entries from sync

Transfer transactions with kind "investment_contribution" were not recognized
as transfers by the UI, causing missing +/- indicators, "Transfer" labels,
and showing regular transaction forms instead of transfer details.

Also adds user_modified: true to entries created via TransferMatchesController
and SetAsTransferOrPayment rule action to protect them from provider sync
overwrites, matching the existing behavior in Transfer::Creator.

https://claude.ai/code/session_019BZ5Z1aqKSK3cRdR81P5Jg

* fix: Centralize transfer/budget kind constants for consistent investment_contribution handling

Define TRANSFER_KINDS and BUDGET_EXCLUDED_KINDS on Transaction to eliminate
hard-coded kind lists scattered across filters, rules, and analytics code.

investment_contribution is now consistently treated as a transfer in search
filters, rule conditions, and UI display (via TRANSFER_KINDS), while budget
analytics correctly continue treating it as an expense (via BUDGET_EXCLUDED_KINDS).

https://claude.ai/code/session_019BZ5Z1aqKSK3cRdR81P5Jg

* fix: Update tests for consistent investment_contribution as transfer kind

- search_test: loan_payment is now in TRANSFER_KINDS, so uncategorized
  filter correctly excludes it (same as funds_movement/cc_payment)
- condition_test: investment_contribution is now a transfer kind, so it
  matches the transfer filter rather than expense filter

https://claude.ai/code/session_019BZ5Z1aqKSK3cRdR81P5Jg

* fix: Eliminate SQL injection warnings in Transaction::Search

Replace string-interpolated SQL with parameterized queries:
- totals: use sanitize_sql_array with ? placeholders
- apply_category_filter: pass TRANSFER_KINDS as bind parameter
- apply_type_filter: use where(kind:)/where.not(kind:) and
  parameterized IN (?) for compound OR conditions
- Remove unused transfer_kinds_sql helper

https://claude.ai/code/session_019BZ5Z1aqKSK3cRdR81P5Jg

---------

Co-authored-by: Claude <noreply@anthropic.com>

test/controllers/transfer_matches_controller_test.rb

@@ -40,6 +40,22 @@ class TransferMatchesControllerTest < ActionDispatch::IntegrationTest
     assert_equal "Transfer created", flash[:notice]
   end
 
+  test "new transfer entry is protected from provider sync" do
+    outflow_entry = create_transaction(amount: 100, account: accounts(:depository))
+
+    post transaction_transfer_match_path(outflow_entry), params: {
+      transfer_match: {
+        method: "new",
+        target_account_id: accounts(:investment).id
+      }
+    }
+
+    transfer = Transfer.order(created_at: :desc).first
+    new_entry = transfer.inflow_transaction.entry
+
+    assert new_entry.user_modified?, "New transfer entry should be marked as user_modified to protect from provider sync"
+  end
+
   test "assigns investment_contribution kind and category for investment destination" do
     # Outflow from depository (positive amount), target is investment
     outflow_entry = create_transaction(amount: 100, account: accounts(:depository))

test/models/rule/condition_test.rb

@@ -447,7 +447,7 @@ class Rule::ConditionTest < ActiveSupport::TestCase
     assert_not filtered.map(&:id).include?(transfer_entry.transaction.id)
   end
 
-  test "transaction_type expense includes investment_contribution regardless of amount sign" do
+  test "transaction_type transfer includes investment_contribution" do
     scope = @rule_scope
 
     # Create investment contribution with negative amount (inflow from provider)
@@ -463,14 +463,27 @@ class Rule::ConditionTest < ActiveSupport::TestCase
       rule: @transaction_rule,
       condition_type: "transaction_type",
       operator: "=",
-      value: "expense"
+      value: "transfer"
     )
 
     scope = condition.prepare(scope)
     filtered = condition.apply(scope)
 
-    # Should include investment_contribution even with negative amount
+    # investment_contribution is a transfer kind
     assert filtered.map(&:id).include?(contribution_entry.transaction.id)
+
+    # Should NOT match expense filter
+    expense_condition = Rule::Condition.new(
+      rule: @transaction_rule,
+      condition_type: "transaction_type",
+      operator: "=",
+      value: "expense"
+    )
+
+    expense_scope = expense_condition.prepare(@rule_scope)
+    expense_filtered = expense_condition.apply(expense_scope)
+
+    assert_not expense_filtered.map(&:id).include?(contribution_entry.transaction.id)
   end
 
   test "transaction_type income excludes investment_contribution" do

test/models/transaction/search_test.rb

@@ -119,11 +119,10 @@ class Transaction::SearchTest < ActiveSupport::TestCase
 
     # Should include standard uncategorized transactions
     assert_includes uncategorized_ids, uncategorized_standard.entryable.id
-    # Should include loan_payment since it's treated specially in category logic
-    assert_includes uncategorized_ids, uncategorized_loan_payment.entryable.id
 
-    # Should exclude transfer transactions even if uncategorized
+    # Should exclude all transfer kinds (TRANSFER_KINDS) even if uncategorized
     assert_not_includes uncategorized_ids, uncategorized_transfer.entryable.id
+    assert_not_includes uncategorized_ids, uncategorized_loan_payment.entryable.id
   end
 
   test "filtering for only Uncategorized returns only uncategorized transactions" do
@@ -237,10 +236,50 @@ class Transaction::SearchTest < ActiveSupport::TestCase
 
     # Test that the relation builds from family.transactions correctly
     assert_equal @family.transactions.joins(entry: :account).where(
-      "entries.amount >= 0 AND NOT (transactions.kind IN ('funds_movement', 'cc_payment', 'loan_payment'))"
+      "entries.amount >= 0 AND NOT (transactions.kind IN (?))", Transaction::TRANSFER_KINDS
     ).count, results.count
   end
 
+  test "transfer filter includes investment_contribution transactions" do
+    investment_contribution = create_transaction(
+      account: @checking_account,
+      amount: 500,
+      kind: "investment_contribution"
+    )
+
+    funds_movement = create_transaction(
+      account: @checking_account,
+      amount: 200,
+      kind: "funds_movement"
+    )
+
+    search = Transaction::Search.new(@family, filters: { types: [ "transfer" ] })
+    result_ids = search.transactions_scope.pluck(:id)
+
+    assert_includes result_ids, investment_contribution.entryable.id
+    assert_includes result_ids, funds_movement.entryable.id
+  end
+
+  test "expense filter excludes investment_contribution transactions" do
+    investment_contribution = create_transaction(
+      account: @checking_account,
+      amount: 500,
+      kind: "investment_contribution"
+    )
+
+    standard_expense = create_transaction(
+      account: @checking_account,
+      amount: 100,
+      kind: "standard"
+    )
+
+    search = Transaction::Search.new(@family, filters: { types: [ "expense" ] })
+    result_ids = search.transactions_scope.pluck(:id)
+
+    assert_not_includes result_ids, investment_contribution.entryable.id
+    assert_includes result_ids, standard_expense.entryable.id
+  end
+
   test "family-based API requires family parameter" do
     assert_raises(NoMethodError) do
       search = Transaction::Search.new({ types: [ "expense" ] })

test/models/transaction_test.rb

@@ -32,6 +32,17 @@ class TransactionTest < ActiveSupport::TestCase
     assert transaction.investment_contribution?
   end
 
+  test "TRANSFER_KINDS constant matches transfer? method" do
+    Transaction::TRANSFER_KINDS.each do |kind|
+      assert Transaction.new(kind: kind).transfer?, "#{kind} should be a transfer kind"
+    end
+
+    non_transfer_kinds = Transaction.kinds.keys - Transaction::TRANSFER_KINDS
+    non_transfer_kinds.each do |kind|
+      assert_not Transaction.new(kind: kind).transfer?, "#{kind} should NOT be a transfer kind"
+    end
+  end
+
   test "all transaction kinds are valid" do
     valid_kinds = %w[standard funds_movement cc_payment loan_payment one_time investment_contribution]
 

test/models/transfer/creator_test.rb

@@ -28,6 +28,7 @@ class Transfer::CreatorTest < ActiveSupport::TestCase
     # Verify outflow transaction is marked as investment_contribution
     outflow = transfer.outflow_transaction
     assert_equal "investment_contribution", outflow.kind
+    assert outflow.transfer?, "investment_contribution should be recognized as a transfer"
     assert_equal @amount, outflow.entry.amount
     assert_equal @source_account.currency, outflow.entry.currency
     assert_equal "Transfer to #{@destination_account.name}", outflow.entry.name
@@ -36,6 +37,7 @@ class Transfer::CreatorTest < ActiveSupport::TestCase
     # Verify inflow transaction (always funds_movement)
     inflow = transfer.inflow_transaction
     assert_equal "funds_movement", inflow.kind
+    assert inflow.transfer?, "funds_movement should be recognized as a transfer"
     assert_equal(@amount * -1, inflow.entry.amount)
     assert_equal @destination_account.currency, inflow.entry.currency
     assert_equal "Transfer from #{@source_account.name}", inflow.entry.name